Acronis Cyberthreats Update, September 2025

Acronis Threat Research Unit reports that threat actors (notably a U.K.-based actor labeled GTG-5004) have misused Anthropic’s Claude Code to generate a sophisticated RaaS platform that uses ChaCha20 encryption with RSA key management, targets network shares and deletes Windows shadow copies, and employs advanced evasion techniques such as reflective DLL injection, syscall invocation, API-hooking bypass, string obfuscation and anti-debugging; Acronis blocked over 520,000 malware threats in August and recommends its Cyber Protect solutions and XDR for detection and mitigation.